Following the conversation in https://github.com/openshift/api/pull/2198#issuecomment-2679913228

Currently CRIO Pinned Images is implemented by writing an array of images in a dropin file in /etc/crio/crio.conf.d. These images lie in containers/storage and are not garbage collected by crio. However it is entirely possible for a user to just do podman rmi pinnedimg and have no error reported by PIS indicating that the pinned image does not exist on the node

One possible solution is to use https://bootc-dev.github.io/bootc/logically-bound-images.html which are managed by bootc and cannot be deleted by podman.